StackLégal
Server Details
GDPR provider fiches and a static cookie scan before consent.
- Status
- Healthy
- Uptime
- 100.0% over 24 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
- ChatGPT
- –
- Claude
- –
TDQS
Scored across 3 tools
get_provider (one fiche) and list_providers (many fiches) are clearly complementary rather than overlapping, and scan_site targets an entirely different action (fetching a URL and reporting trackers). No two tools can plausibly be confused for one another.
All three names follow a clean verb_noun snake_case pattern (get_provider, list_providers, scan_site). Consistent convention throughout with no deviations.
Three tools is on the lean side but defensible for a read-only catalog-plus-scanner service where each tool mirrors a distinct API endpoint. Nothing feels redundant, though it sits near the thin end of the range.
The surface covers the core read operations—single lookup, batch/full listing, and site scanning with tracker-to-fiche mapping—mirroring the underlying GET endpoints. Minor gaps remain, such as no fuzzy/text search for providers beyond exact slug/alias/name matching.
Available Tools
3 toolsget_providerGet a providerARead-onlyInspect
Look up one StackLégal provider fiche by canonical slug, alias (for example ga), or exact catalog name. Returns the same object as GET /api/v1/providers/{slug}. A name match is not a legal qualification. lang defaults to French.
| Name | Required | Description | Default |
|---|---|---|---|
| lang | No | Optional shipped locale. Omit for French. Slugs do not change with language. | |
| slug_or_name | Yes | Canonical slug, alias, or exact provider name as shown on the fiche. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so safety is covered; the description adds value with the return-shape equivalence ('same object as GET /api/v1/providers/{slug}') and the language default behavior. It stops short of describing error cases when no fiche matches.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences: the primary operation and identifier forms lead, then the return-shape note, then the language default. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by naming the equivalent REST endpoint so the agent can infer the return object, and it covers the lang default. Only the no-match/error behavior is left unstated for this simple read tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already documented in the schema. The description only reinforces that lang defaults to French and gives an alias example ('ga'), adding marginal meaning beyond the structured fields. Baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (look up) and resource (one StackLégal provider fiche), and explicitly enumerates the three accepted identifier forms (canonical slug, alias, exact catalog name). This clearly separates it from the sibling list_providers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies single-record retrieval versus listing, and warns that a name match is not a legal qualification, but never explicitly routes to alternatives (e.g. 'use list_providers to enumerate'). Usage context is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_providersList providersARead-onlyInspect
List StackLégal provider fiches. Same payload as GET /api/v1/providers. Pass ids to request specific slugs, 81 at most, in that order. Omit ids for the full catalog. Unknown slugs are returned in unknown and the rest still succeeds. lang defaults to French.
| Name | Required | Description | Default |
|---|---|---|---|
| ids | No | Optional slugs or aliases. Omit for the full catalog. | |
| lang | No | Optional shipped locale. Omit for French. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, destructiveHint=false and openWorldHint=false, so safety is covered. The description adds real behavioral detail beyond that: unknown slugs go to an 'unknown' field and the rest of the call still succeeds, plus the 81-item cap and default French locale.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four tight sentences, front-loaded with the purpose and the id-handling rules; nothing is padded. The 'Same payload as GET /api/v1/providers' sentence is only marginally useful to an agent that never sees the REST surface.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter read tool with full annotation coverage and no output schema, the description covers the important edge cases (partial failure via 'unknown', item cap, ordering, locale default). It stops short of describing pagination or the exact response shape, but that is a minor gap here.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, and the description genuinely adds meaning: the 81-slug maximum, order preservation, and how unknown slugs are handled rather than failing the call. The lang default of French largely repeats the schema wording, which caps this below 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List StackLégal provider fiches') and clarifies scope: specific slugs via ids or the full catalog when omitted. It does not explicitly contrast itself with the sibling get_provider (single-provider fetch), so differentiation is only implicit through naming.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear selection rules: pass ids for specific slugs, omit for the full catalog, with a hard limit of 81 and preserved ordering. It never names get_provider as the alternative for a single record, so the when-not condition is inferred rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_siteScan a site before consentARead-onlyInspect
Fetch one public URL once, without a consent cookie, and report trackers present on the first HTML response and Set-Cookie headers. JavaScript is not executed. Each tracker includes a provider slug when the scanner catalog maps it to a fiche, and the result links to the StackLégal scanner page. This is not a legal qualification. The address and the caller IP are not stored. Limited to a few scans per 10 minutes.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | Public http or https URL on port 80 or 443, with no username in the address. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations' safety profile: no JavaScript execution, results limited to the first HTML response and Set-Cookie headers only, no consent cookie sent, address and caller IP not stored, and an explicit rate limit of a few scans per 10 minutes. It also disclaims legal qualification, which guards against over-interpreting results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four tight sentences, each carrying distinct load: scope, method limits, output contents, privacy, rate limit. The core operation is front-loaded in the first clause; nothing is padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description still tells the agent what comes back (tracker list with provider slugs where the catalog maps to a fiche, plus a link to the scanner page). Privacy, rate limit, and the legal caveat round out what an agent needs to call and interpret this correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and there is a single parameter, so the schema already documents the URL format (http/https, ports 80/443, no username). The description restates 'public URL' and the no-consent condition without adding parameter-level syntax or format detail beyond the schema, matching the baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (fetch/report) and resource (one public URL's HTML response and Set-Cookie headers) with the precise scope: single fetch, no consent cookie, no JS execution. This is clearly a one-off site scan, readily distinguishable from catalog lookups like get_provider/list_providers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'before consent' framing implies the use case and the rate limit signals it is not for bulk work, but the description never explicitly says when to choose this over the sibling provider-catalog tools or when not to scan. Usage is inferable rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
- First observed
get_provider - First observed
list_providers - First observed
scan_site
Related MCP Connectors
GDPR/CCPA cookie consent: scan sites for cookies, track consent rates, generate privacy policies.
Cookie consent for GDPR/CCPA: scan sites for trackers, configure consent banners, get install code.
GDPR cookie banner with Consent Mode v2: install snippet, cookie scan and site management.
81Cookie consent scanner: GDPR, CCPA, GCMv2. PASS/FAIL compliance checklists with fix recommendations.
Related MCP Servers
- AlicenseAqualityAmaintenanceEnables AI coding agents to generate LGPD-compliant cookie banners by detecting trackers in local projects, and to scan published sites for privacy violations, returning actionable results.18255 npmApache 2.0
- AlicenseAqualityBmaintenanceEnables auditing one or many websites from an EU address for cookie consent behavior, returning per-domain rows on the consent platform, first-layer reject availability, trackers and tracking cookies before consent and after reject, and Global Privacy Control response. Runs the work on Apify and hands back the dataset rows through a single tool.156 npmMIT
- AlicenseNot gradedqualityCmaintenanceProvides GDPR compliance scanning for websites via the MCP protocol, with pay-per-call using x402 micropayments.MIT
- AlicenseAqualityBmaintenanceOne-step legal compliance for vibe-coded apps: scans project, generates privacy policies/TOS, installs cookie consent banner, and checks EU AI Act risk.10127 npmMIT
Glama MCP Gateway
Add one secure layer between your agents and this server.